SQL Injection Vulnerability in UTMStack Product by UTMStack
CVE-2026-82039

8.7HIGH

Key Information:

Vendor

Utmstack

Status
Utmstack
Vendor
CVE Published:
2 October 2026

What is CVE-2026-82039?

UTMStack versions prior to 11.2.16 are susceptible to a SQL injection vulnerability in the UtmAssetGroupService.searchQueryBuilder() method. This flaw allows authenticated users to execute arbitrary SQL commands by inputting malicious values for assetType and groupName. Specifically, the GET /api/utm-asset-groups/searchGroupsByFilter endpoint processes these unsanitized inputs through String.format(), facilitating potential full database read access, data modifications, and even unauthorized filesystem access. This poses significant security risks and requires immediate attention to mitigate possible exploit scenarios.

Affected Version(s)

UTMStack 0 < 11.2.16

References

https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16
release-notes
https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8...
patch
https://www.vulncheck.com/advisories/utmstack-sql-injecti...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Nurudini (QwesiRED)
VulnCheck
.